Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through unbounded session retention in the handleInitRequest path of WebFluxStreamableServerTransportProvider and WebMvcStreamableServerTransportProvider. An unauthenticated remote...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through unbounded session retention in the handleInitRequest path of WebFluxStreamableServerTransportProvider and WebMvcStreamableServerTransportProvider. An unauthenticated remote...

CVE-2026-59279 Unbounded persistent session allocation via repeated initialize requests

The MCP Streamable HTTP server transport WebFlux and WebMvc variants does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a result, a remote attacker can cause the server to accumulate an unbounded number of sessions over...

cve-2026-59279 - HIGH - Unbounded persistent session allocation via repeated initialize requests

cve-2026-59279 - HIGH - Unbounded persistent session allocation via repeated initialize requests...